Junglewise Threat Intelligence

CVE-2024-39918: @jmondi/url-to-png path traversal in image storage

CVE-2024-39918 · Severity: low · CVSS 3.1 · Published 2024-07-15

Technologies: @jmondi/url-to-png (npm). Vendors: npm.

Executive brief

@jmondi/url-to-png is a Node.js library that converts URLs to PNG images and stores them on disk. A path traversal vulnerability allows attackers to write PNG files to arbitrary locations on the server's filesystem by injecting directory traversal sequences (such as `../`) into query parameters, potentially overwriting system files or placing malicious content outside the intended storage directory.

Technical details

The vulnerability exists in the image ID construction logic (extract_query_params.ts), where user-supplied query parameters are concatenated into a filesystem path without proper sanitization. Specifically, the `configToString()` function converts request parameters directly into the imageId string, which is later joined with the storage path using `path.join()`. An attacker can inject path traversal sequences (e.g., `../../../../tmp/hack`) via any non-numeric parameter to write files outside the intended storage directory. The vulnerability requires network access and no authentication; exploitation results in arbitrary file write capability on the filesystem. A patch was released in version 2.1.2 that applies the `slugify()` function to sanitize all parameters before path construction.

Affected products

  • Jason Raimondi @jmondi/url-to-png <2.1.2

Timeline

  • 2024-07-15: disclosed
  • 2024-07-15: patched: Fixed in version 2.1.2

References

Related threats